Power your agent
คำสั่งของผู้เผยแพร่เอง ไม่ใช่เอนด์พอยต์ของ PlugMCP
Host a copy with our keys and logs.
docker run -i --rm ghcr.io/sowhati/vaultshell:0.1.2Claude Code ไม่มีลิงก์ติดตั้งสำหรับคำสั่งแบบโลคัล ให้คัดลอกคำสั่งด้านล่างแล้วรันในเทอร์มินัล
claude mcp add io.github.sowhati-vaultshell -- docker run -i --rm ghcr.io/sowhati/vaultshell:0.1.2รันในเทอร์มินัล
{ "mcpServers": { "io.github.sowhati-vaultshell": { "command": "docker", "args": [ "run", "-i", "--rm", "ghcr.io/sowhati/vaultshell:0.1.2" ] } }}claude_desktop_config.json
URL แบบรีโมตหรือคำสั่งบนเครื่องของคุณ? การติดตั้งสองแบบต่างกันอย่างไร
รันบน PlugMCP
A new server you create. It is not this listing's official endpoint. Use the publisher install when you want their URL and their credentials.
เปิดจากผู้เผยแพร่
English | 简体中文
Injects secrets into shell commands at exec time; plaintext never reaches the LLM context
Available on the official MCP Registry: io.github.SoWhatI/vaultshell
An MCP server that stores secrets in local secure storage, injects them into shell child processes at exec time based on rules, and guarantees secret plaintext never reaches the model context — not in tool responses, not in logs, not in audit records.
The closed loop: reference-based storage + conditional injection + mandatory output redaction.
Status: M3 — one-shot commands + persistent sessions + credential proxy + external CLI backends. See CHANGELOG and docs/design-spec.md.
[REDACTED:NAME]), and redacted output.env and never pass through the tool layer.shell_exec has no free-form env parameter. Secrets enter by rule
reference only.Requires Node.js 20+.
# Run on demand directly from the repo (npm installs devDependencies and
# builds dist/ via the `prepare` script):
npx -y github:SoWhatI/vaultshell
# Or install globally:
npm i -g github:SoWhatI/vaultshell
This is the same code as the npm registry package, installed from git —
npm clones the repo, runs prepare (→ npm run build) and links the
vaultshell bin. Pin a tag for reproducibility:
npx -y github:SoWhatI/vaultshell#v0.1.1.
docker run -i --rm \
-e MASTER_KEY=<64 hex chars> \
-v ~/.vaultshell:/home/node/.vaultshell \
ghcr.io/sowhati/vaultshell:latest
MCP client config using Docker:
{
"mcpServers": {
"vaultshell": {
"command": "docker",
"args": [
"run", "-i", "--rm",
"-e", "MASTER_KEY=<64 hex chars>",
"-v", "~/.vaultshell:/home/node/.vaultshell",
"ghcr.io/sowhati/vaultshell:latest"
]
}
}
}
The image runs as the non-root node user (HOME=/home/node), so the data
volume mounts at /home/node/.vaultshell. node-pty is excluded from the
image — sessions automatically fall back to pipe mode (pty: false) in
containers; injection and redaction are unchanged. The web subcommand
passes through (docker run … ghcr.io/sowhati/vaultshell web — loopback
inside the container, of limited use).
No Smithery distribution: Smithery has gone hosted-only (it only accepts servers deployed to its own infrastructure). vaultshell's secrets must stay on the user's machine by design — third-party hosting is incompatible with its threat model, so we deliberately do not publish there.
# Run via npx (after publish) or from source:
npm install && npm run build
# 1. Create a master key for the encrypted-file backend
export MASTER_KEY=$(openssl rand -hex 32)
# 2. Create ~/.vaultshell/config.yaml and ~/.vaultshell/rules.yaml
# (full annotated examples: docs/user-guide.md)
# 3. Store a secret (never echoed back) and run with injection
# via your MCP client's tools: secret_set, then shell_exec
Claude Desktop (claude_desktop_config.json):
{
"mcpServers": {
"vaultshell": {
"command": "npx",
"args": ["-y", "vaultshell"],
"env": { "MASTER_KEY": "<64 hex chars>" }
}
}
}
Full setup, configuration reference, rule-writing guide, client integration, and FAQ: docs/user-guide.md.
dryRun: true on shell_exec reports the would-be ruleId, injected
names, final env key list (never values) and the deny-list verdict —
without executing anything.timeoutSeconds (default defaults.execTimeoutSeconds = 120, capped at
3600) kills the command and returns timedOut: true.defaults.maxOutputBytes (default 1 MiB) truncates each output stream and
sets truncated: true. Truncation happens after the Redactor — it can
never bypass redaction.defaults.maxConcurrentExecs (default 8) rejects excess concurrent
shell_exec calls with a clear error (no queue).dryRun / timedOut /
truncated flags).vaultshell web # loopback-only HTTP UI on a random port
vaultshell web --port 5317
Prints a one-time-token URL like http://127.0.0.1:5317/?token=… — open it
to manage secrets (write-only), edit rules with live static-validation
warnings and a matcher dry-run, edit config, and browse the redacted audit
log. The token dies with the process; every API call needs it, mutations
require same-origin application/json requests, and no endpoint can ever
return a secret value. Do not port-forward it. Design & threat model:
docs/web-config-ui-design.md.
For high-sensitivity API tokens, prefer not landing the secret in env at
all. Declare a proxy in config.yaml:
proxies:
- id: stripe
upstreamHost: https://api.stripe.com
secretRef: STRIPE_KEY # registry name or full ref
headerTemplate: "Authorization: Bearer ${value}"
Then shell_proxy_start { "id": "stripe" } → { port, expiresAt }, and
commands call http://127.0.0.1:<port>/v1/charges instead of
https://api.stripe.com/v1/charges. The proxy injects the header in
memory only and auto-stops after its TTL (default 300s). Audit records the
host and secret name, never the header value.
Boundaries: http:///https:// upstreams only (proxy→upstream TLS is
properly validated; no CONNECT tunneling, no TLS termination); the
client→proxy leg is plaintext on 127.0.0.1, which inherits the same-UID
local-process boundary from the threat model.
shell_session_open spawns a long-lived shell with the matched rule's
secrets injected at creation. The session is recycled after an idle TTL
(defaults.sessionTtlSeconds, default 900s, overridable per rule via
ttlSeconds or per call) — when the process dies, the secrets die with it.
shell_session_revoke kills a possibly-compromised session immediately and
rebuilds one without any secrets.
Sessions use a real PTY via node-pty
(an optional dependency — native build, needs Xcode CLT on macOS /
build-essential + python3 on Linux). If node-pty cannot be loaded or spawned,
vaultshell automatically falls back to a plain child_process shell and the
shell_session_open response says pty: false; injection and redaction
behave identically, only interactivity is degraded. Session output merges
stdout/stderr (PTY semantics) and passes through the same Redactor.
Details, per-backend setup, and how to register a plugin resolver: docs/backends.md.
Full discussion: docs/design-spec.md §7. Report vulnerabilities privately per SECURITY.md.
~/.vaultshell/
config.yaml # main config
rules.yaml # injection rules + secret refs (refs only, never values)
secrets.enc # encrypted-file backend (0600)
audit/ # JSONL audit, redacted
VAULTSHELL_HOME overrides the data directory (used by tests).
npm run build # tsc
npm test # vitest — redactor property tests, backend round-trips,
# rule matching, shell_exec end-to-end
See CONTRIBUTING.md — including the security red lines every PR must respect.
MIT © 2026 vaultshell contributors
Injects secrets into shell commands at exec time; plaintext never reaches the LLM context
{ "mcpServers": { "io.github.sowhati-vaultshell": { "command": "docker", "args": [ "run", "-i", "--rm", "ghcr.io/sowhati/vaultshell:0.1.2" ] } }}เครื่องมือ
ยังไม่มีรายการเครื่องมือ เซิร์ฟเวอร์แบบรีโมตจะได้รายการหลังการตรวจสอบสถานะครั้งแรก
FAQ
คัดลอกคอนฟิก stdio สำหรับ Cursor, Claude Desktop, Claude Code หรือ VS Code ได้ในหน้านี้ คอนฟิกนี้ใช้การติดตั้งของผู้เผยแพร่ ไม่ใช่พร็อกซีของ PlugMCP
ระเบียนนี้ไม่ได้ระบุตัวแปรสภาพแวดล้อมที่จำเป็น
Vaultshell ทำงานแบบโลคัลผ่าน stdio
ตรวจสอบล่าสุดเมื่อ 2026-11-09 Injects secrets into shell commands at exec time; plaintext never reaches the LLM context